Analysis Report Locky

Source: Locky.exe

Avira: detection malicious, Label: TR/Agent.53465

Multi AV Scanner detection for submitted file

Source: Locky.exe	Virustotal: Detection: 94%	Perma Link
Source: Locky.exe	Metadefender: Detection: 84%	Perma Link
Source: Locky.exe	ReversingLabs: Detection: 95%

Machine Learning detection for sample

Source: Locky.exe

Joe Sandbox ML: detected

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Locky ransomware

Source: Yara match	File source: Locky.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: Locky.exe PID: 2320, type: MEMORY
Source: Yara match	File source: 0.2.Locky.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Locky.exe.400000.0.unpack, type: UNPACKEDPE

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\Windows\AppCompat\Programs\Amcache.hve.tmp

Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C23F3	0_2_001C23F3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001D23F3	0_2_001D23F3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001E23F3	0_2_001E23F3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001F23F3	0_2_001F23F3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_008B23F3	0_2_008B23F3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A723F3	0_2_00A723F3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A823F3	0_2_00A823F3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A923F3	0_2_00A923F3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AA23F3	0_2_00AA23F3

Source: unknown

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 452

Source: Locky.exe, 00000000.00000000.1059960207.00000000007B7000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename vs Locky.exe
Source: Locky.exe	Binary or memory string: OriginalFilename vs Locky.exe

Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: phoneinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: ext-ms-win-xblauth-console-l1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: ext-ms-win-xblauth-console-l1.dll	Jump to behavior

Source: classification engine

Classification label: mal68.rans.winEXE@2/4@0/0

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\Users\user\AppData\Local\DBG

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2320

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER64D5.tmp

Source: Locky.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Locky.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Locky.exe	Virustotal: Detection: 94%
Source: Locky.exe	Metadefender: Detection: 84%
Source: Locky.exe	ReversingLabs: Detection: 95%

Source: unknown	Process created: C:\Users\user\Desktop\Locky.exe 'C:\Users\user\Desktop\Locky.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 452

Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C040D push AF0FD0FFh; retf	0_2_001C0414
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C2A0B push AF0FD0FFh; retf	0_2_001C2A12
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C1A30 push AF0FD0FFh; retf	0_2_001C1A37
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C1822 push AF0FD0FFh; retf	0_2_001C1829
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C2023 push AF0FD0FFh; retf	0_2_001C202A
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C085A push AF0FD0FFh; retf	0_2_001C0861
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C024F push AF0FD0FFh; retf	0_2_001C0256
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C2876 push AF0FD0FFh; retf	0_2_001C287D
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C2461 push AF0FD0FFh; retf	0_2_001C2468
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C2298 push AF0FD0FFh; retf	0_2_001C229F
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C1685 push AF0FD0FFh; retf	0_2_001C168C
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C02A1 push AF0FD0FFh; retf	0_2_001C0369
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C10A3 push AF0FD0FFh; retf	0_2_001C10AA
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C1ADD push AF0FD0FFh; retf	0_2_001C1AE4
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C20F4 push AF0FD0FFh; retf	0_2_001C20FB
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C18EA push AF0FD0FFh; retf	0_2_001C18F1
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C26E6 push AF0FD0FFh; retf	0_2_001C26ED
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C0515 push AF0FD0FFh; retf	0_2_001C051C
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C0738 push AF0FD0FFh; retf	0_2_001C073F
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C2336 push AF0FD0FFh; retf	0_2_001C233D
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C2B28 push AF0FD0FFh; retf	0_2_001C2B2F
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C1B5F push edx; ret	0_2_001C1B60
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C2952 push AF0FD0FFh; retf	0_2_001C2959
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C257E push AF0FD0FFh; retf	0_2_001C2585
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C1576 push AF0FD0FFh; retf	0_2_001C157D
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C0362 push AF0FD0FFh; retf	0_2_001C0369
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C019E push AF0FD0FFh; retf	0_2_001C01A5
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C1384 push AF0FD0FFh; retf	0_2_001C138B
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C05B2 push AF0FD0FFh; retf	0_2_001C05B9
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C21D8 push AF0FD0FFh; retf	0_2_001C21DF
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C2BDB push AF0FD0FFh; retf	0_2_001C2BE2

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Locky.exe TID: 5028	Thread sleep time: -31000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

File opened: PhysicalDrive0

Source: C:\Users\user\Desktop\Locky.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\WerFault.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C05E4 mov eax, dword ptr fs:[00000030h]	0_2_001C05E4
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C0604 mov eax, dword ptr fs:[00000030h]	0_2_001C0604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C0604 mov eax, dword ptr fs:[00000030h]	0_2_001C0604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C0864 mov eax, dword ptr fs:[00000030h]	0_2_001C0864
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C06A7 mov eax, dword ptr fs:[00000030h]	0_2_001C06A7
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C06CA mov eax, dword ptr fs:[00000030h]	0_2_001C06CA
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C0757 mov eax, dword ptr fs:[00000030h]	0_2_001C0757
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C0751 mov eax, dword ptr fs:[00000030h]	0_2_001C0751
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C0742 mov eax, dword ptr fs:[00000030h]	0_2_001C0742
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C07D3 mov eax, dword ptr fs:[00000030h]	0_2_001C07D3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C05FD mov eax, dword ptr fs:[00000030h]	0_2_001C05FD
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001C07EC mov eax, dword ptr fs:[00000030h]	0_2_001C07EC
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001D05E4 mov eax, dword ptr fs:[00000030h]	0_2_001D05E4
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001D0604 mov eax, dword ptr fs:[00000030h]	0_2_001D0604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001D0604 mov eax, dword ptr fs:[00000030h]	0_2_001D0604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001D0864 mov eax, dword ptr fs:[00000030h]	0_2_001D0864
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001D06A7 mov eax, dword ptr fs:[00000030h]	0_2_001D06A7
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001D06CA mov eax, dword ptr fs:[00000030h]	0_2_001D06CA
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001D0757 mov eax, dword ptr fs:[00000030h]	0_2_001D0757
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001D0751 mov eax, dword ptr fs:[00000030h]	0_2_001D0751
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001D0742 mov eax, dword ptr fs:[00000030h]	0_2_001D0742
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001D07D3 mov eax, dword ptr fs:[00000030h]	0_2_001D07D3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001D05FD mov eax, dword ptr fs:[00000030h]	0_2_001D05FD
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001D07EC mov eax, dword ptr fs:[00000030h]	0_2_001D07EC
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001E05E4 mov eax, dword ptr fs:[00000030h]	0_2_001E05E4
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001E0604 mov eax, dword ptr fs:[00000030h]	0_2_001E0604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001E0604 mov eax, dword ptr fs:[00000030h]	0_2_001E0604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001E0864 mov eax, dword ptr fs:[00000030h]	0_2_001E0864
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001E06A7 mov eax, dword ptr fs:[00000030h]	0_2_001E06A7
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001E06CA mov eax, dword ptr fs:[00000030h]	0_2_001E06CA
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001E0757 mov eax, dword ptr fs:[00000030h]	0_2_001E0757
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001E0751 mov eax, dword ptr fs:[00000030h]	0_2_001E0751
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001E0742 mov eax, dword ptr fs:[00000030h]	0_2_001E0742
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001E07D3 mov eax, dword ptr fs:[00000030h]	0_2_001E07D3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001E05FD mov eax, dword ptr fs:[00000030h]	0_2_001E05FD
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001E07EC mov eax, dword ptr fs:[00000030h]	0_2_001E07EC
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001F05E4 mov eax, dword ptr fs:[00000030h]	0_2_001F05E4
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001F0604 mov eax, dword ptr fs:[00000030h]	0_2_001F0604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001F0604 mov eax, dword ptr fs:[00000030h]	0_2_001F0604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001F0864 mov eax, dword ptr fs:[00000030h]	0_2_001F0864
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001F06A7 mov eax, dword ptr fs:[00000030h]	0_2_001F06A7
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001F06CA mov eax, dword ptr fs:[00000030h]	0_2_001F06CA
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001F0757 mov eax, dword ptr fs:[00000030h]	0_2_001F0757
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001F0751 mov eax, dword ptr fs:[00000030h]	0_2_001F0751
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001F0742 mov eax, dword ptr fs:[00000030h]	0_2_001F0742
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001F07D3 mov eax, dword ptr fs:[00000030h]	0_2_001F07D3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001F05FD mov eax, dword ptr fs:[00000030h]	0_2_001F05FD
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_001F07EC mov eax, dword ptr fs:[00000030h]	0_2_001F07EC
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_008B07EC mov eax, dword ptr fs:[00000030h]	0_2_008B07EC
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_008B05E4 mov eax, dword ptr fs:[00000030h]	0_2_008B05E4
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_008B06A7 mov eax, dword ptr fs:[00000030h]	0_2_008B06A7
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_008B06CA mov eax, dword ptr fs:[00000030h]	0_2_008B06CA
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_008B0604 mov eax, dword ptr fs:[00000030h]	0_2_008B0604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_008B0604 mov eax, dword ptr fs:[00000030h]	0_2_008B0604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_008B0864 mov eax, dword ptr fs:[00000030h]	0_2_008B0864
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_008B07D3 mov eax, dword ptr fs:[00000030h]	0_2_008B07D3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_008B05FD mov eax, dword ptr fs:[00000030h]	0_2_008B05FD
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_008B0742 mov eax, dword ptr fs:[00000030h]	0_2_008B0742
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_008B0751 mov eax, dword ptr fs:[00000030h]	0_2_008B0751
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_008B0757 mov eax, dword ptr fs:[00000030h]	0_2_008B0757
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A705E4 mov eax, dword ptr fs:[00000030h]	0_2_00A705E4
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A706A7 mov eax, dword ptr fs:[00000030h]	0_2_00A706A7
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A706CA mov eax, dword ptr fs:[00000030h]	0_2_00A706CA
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A70604 mov eax, dword ptr fs:[00000030h]	0_2_00A70604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A70604 mov eax, dword ptr fs:[00000030h]	0_2_00A70604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A70864 mov eax, dword ptr fs:[00000030h]	0_2_00A70864
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A707EC mov eax, dword ptr fs:[00000030h]	0_2_00A707EC
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A705FD mov eax, dword ptr fs:[00000030h]	0_2_00A705FD
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A707D3 mov eax, dword ptr fs:[00000030h]	0_2_00A707D3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A70742 mov eax, dword ptr fs:[00000030h]	0_2_00A70742
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A70757 mov eax, dword ptr fs:[00000030h]	0_2_00A70757
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A70751 mov eax, dword ptr fs:[00000030h]	0_2_00A70751
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A805E4 mov eax, dword ptr fs:[00000030h]	0_2_00A805E4
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A806A7 mov eax, dword ptr fs:[00000030h]	0_2_00A806A7
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A806CA mov eax, dword ptr fs:[00000030h]	0_2_00A806CA
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A80604 mov eax, dword ptr fs:[00000030h]	0_2_00A80604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A80604 mov eax, dword ptr fs:[00000030h]	0_2_00A80604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A80864 mov eax, dword ptr fs:[00000030h]	0_2_00A80864
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A807EC mov eax, dword ptr fs:[00000030h]	0_2_00A807EC
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A805FD mov eax, dword ptr fs:[00000030h]	0_2_00A805FD
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A807D3 mov eax, dword ptr fs:[00000030h]	0_2_00A807D3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A80742 mov eax, dword ptr fs:[00000030h]	0_2_00A80742
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A80751 mov eax, dword ptr fs:[00000030h]	0_2_00A80751
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A80757 mov eax, dword ptr fs:[00000030h]	0_2_00A80757
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A905E4 mov eax, dword ptr fs:[00000030h]	0_2_00A905E4
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A906A7 mov eax, dword ptr fs:[00000030h]	0_2_00A906A7
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A906CA mov eax, dword ptr fs:[00000030h]	0_2_00A906CA
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A90604 mov eax, dword ptr fs:[00000030h]	0_2_00A90604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A90604 mov eax, dword ptr fs:[00000030h]	0_2_00A90604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A90864 mov eax, dword ptr fs:[00000030h]	0_2_00A90864
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A907EC mov eax, dword ptr fs:[00000030h]	0_2_00A907EC
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A905FD mov eax, dword ptr fs:[00000030h]	0_2_00A905FD
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A907D3 mov eax, dword ptr fs:[00000030h]	0_2_00A907D3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A90742 mov eax, dword ptr fs:[00000030h]	0_2_00A90742
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A90751 mov eax, dword ptr fs:[00000030h]	0_2_00A90751
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00A90757 mov eax, dword ptr fs:[00000030h]	0_2_00A90757
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AA05E4 mov eax, dword ptr fs:[00000030h]	0_2_00AA05E4
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AA06A7 mov eax, dword ptr fs:[00000030h]	0_2_00AA06A7
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AA06CA mov eax, dword ptr fs:[00000030h]	0_2_00AA06CA
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AA0604 mov eax, dword ptr fs:[00000030h]	0_2_00AA0604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AA0604 mov eax, dword ptr fs:[00000030h]	0_2_00AA0604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AA0864 mov eax, dword ptr fs:[00000030h]	0_2_00AA0864
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AA07EC mov eax, dword ptr fs:[00000030h]	0_2_00AA07EC
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AA05FD mov eax, dword ptr fs:[00000030h]	0_2_00AA05FD
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AA07D3 mov eax, dword ptr fs:[00000030h]	0_2_00AA07D3
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AA0742 mov eax, dword ptr fs:[00000030h]	0_2_00AA0742
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AA0751 mov eax, dword ptr fs:[00000030h]	0_2_00AA0751
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AA0757 mov eax, dword ptr fs:[00000030h]	0_2_00AA0757
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AB05E4 mov eax, dword ptr fs:[00000030h]	0_2_00AB05E4
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AB06A7 mov eax, dword ptr fs:[00000030h]	0_2_00AB06A7
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AB06CA mov eax, dword ptr fs:[00000030h]	0_2_00AB06CA
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AB0604 mov eax, dword ptr fs:[00000030h]	0_2_00AB0604
Source: C:\Users\user\Desktop\Locky.exe	Code function: 0_2_00AB0604 mov eax, dword ptr fs:[00000030h]	0_2_00AB0604

Source: C:\Windows\SysWOW64\WerFault.exe

Process token adjusted: Debug

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Remote Management	Winlogon Helper DLL	Process Injection1	Masquerading11	Credential Dumping	Virtualization/Sandbox Evasion2	Application Deployment Software	Data from Local System	Data Encrypted1	Standard Cryptographic Protocol1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Replication Through Removable Media	Service Execution	Port Monitors	Accessibility Features	Virtualization/Sandbox Evasion2	Network Sniffing	Process Discovery1	Remote Services	Data from Removable Media	Exfiltration Over Other Network Medium	Fallback Channels	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
External Remote Services	Windows Management Instrumentation	Accessibility Features	Path Interception	Process Injection1	Input Capture	Security Software Discovery1	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Custom Cryptographic Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Drive-by Compromise	Scheduled Task	System Firmware	DLL Search Order Hijacking	DLL Side-Loading1	Credentials in Files	System Information Discovery11	Logon Scripts	Input Capture	Data Encrypted	Multiband Communication	SIM Card Swap		Premium SMS Toll Fraud
Exploit Public-Facing Application	Command-Line Interface	Shortcut Modification	File System Permissions Weakness	Obfuscated Files or Information1	Account Manipulation	Remote System Discovery1	Shared Webroot	Data Staged	Scheduled Transfer	Standard Cryptographic Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior

Click here to start
Slideshow Behavior Animation

Startup

System is w10x64

Locky.exe (PID: 2320 cmdline: 'C:\Users\user\Desktop\Locky.exe' MD5: B06D9DD17C69ED2AE75D9E40B2631B42)

WerFault.exe (PID: 5524 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 452 MD5: 80E91E3C0F5563E4049B62FCAF5D67AC)

cleanup

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Locky.exe	94%	Virustotal		Browse
Locky.exe	90%	Metadefender		Browse
Locky.exe	96%	ReversingLabs	Win32.Trojan.Locky
Locky.exe	100%	Avira	TR/Agent.53465
Locky.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.Locky.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1034763		Download File
0.0.Locky.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1034763		Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs Download Network PCAP: filtered – full

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	28.0.0 Lapis Lazuli
Analysis ID:	230133
Start date:	14.05.2020
Start time:	08:23:38
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Locky (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.rans.winEXE@2/4@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 1.5% (good quality ratio 1.3%) Quality average: 69.8% Quality standard deviation: 37.5%
HCA Information:	Successful, ratio: 92% Number of executed functions: 259 Number of non-executed functions: 99
Cookbook Comments:	Adjust boot time Enable AMSI Stop behavior analysis, all processes terminated
Warnings:	Show All Exclude process from analysis (whitelisted): WerFault.exe, MusNotifyIcon.exe, svchost.exe, UsoClient.exe Excluded IPs from analysis (whitelisted): 8.248.147.254, 67.27.159.126, 8.253.204.249, 8.248.133.254, 67.26.81.254, 2.18.68.82, 51.104.136.2, 40.127.240.158, 52.158.208.111 Excluded domains from analysis (whitelisted): umwatson.trafficmanager.net, fs.microsoft.com, audownload.windowsupdate.nsatc.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, settings-win.data.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, settingsfd-geo.trafficmanager.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:24:09	API Interceptor	690x Sleep call for process: Locky.exe modified
08:25:38	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Locky.exe_cf7f314a41a72ba64d6a344af1e178bf365a56b_073a1385_15c6737b\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Size (bytes):	9494
Entropy (8bit):	3.7737750687541154
Encrypted:	false
MD5:	B651CDA17856DA50A0B203ED3149C982
SHA1:	B98D4546839859460C098C937846634FCB228FA9
SHA-256:	DC10767D63D435BCD2DC586E3BEF835CFCA7297BDBF11DD5107B2202A847EC90
SHA-512:	E8FB0391E2FC239366C5267531C292345830FBFA3BCFA732C7821CA033EE105D0047BA8469C30141DAB574354FFE15BCC51F9D91D5260247C451F8196F29827D
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.3.3.9.1.1.1.3.4.6.2.8.6.4.5.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.3.3.9.1.1.1.3.7.3.7.3.2.8.6.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.0.0.b.7.8.3.7.-.c.c.8.9.-.4.d.7.3.-.a.0.4.0.-.d.a.8.5.2.1.2.2.8.9.6.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.3.5.0.0.f.b.6.-.3.6.7.0.-.4.c.c.d.-.a.4.7.7.-.1.5.7.d.5.b.4.8.2.7.2.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.L.o.c.k.y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.1.0.-.0.0.0.1.-.0.0.2.3.-.1.1.d.0.-.4.3.4.6.b.8.2.9.d.6.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.7.2.2.a.5.4.c.1.b.a.3.3.6.3.9.f.7.c.c.2.3.c.3.9.d.f.9.d.f.6.5.0.0.0.0.f.f.f.f.!.0.0.0.0.b.6.0.6.a.a.a.4.0.2.b.f.e.4.a.1.5.e.f.8.0.1.6.5.e.9.6.4.d.3.8.4.f.2.5.5.6.4.e.4.!.L.o.c.k.y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER64D5.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu May 14 06:25:35 2020, 0x1205a4 type
Size (bytes):	1064228
Entropy (8bit):	1.8590230819487539
Encrypted:	false
MD5:	576E5C4F95B3AA233B373DF059BAF30C
SHA1:	7F6AD8A030007731BD5E655D575513E10F48FFDC
SHA-256:	B75A927039F60FA20C06B24C45CD2A77F1F9FF71D22CE02F5DB4289FF5115E96
SHA-512:	8BD665405AF5058804B80BEBE8309944C72EA48474BA8F0CDA22F36FEEF18FBF3DC072B4F195DFA81AE1FD5EA3C6440538977EE1B62B9FEC575667C285976950
Malicious:	false
Reputation:	low
Preview:	MDMP....... ......._.^...................?...........B......x.......GenuineIntel............T.............^.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6D52.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Size (bytes):	8296
Entropy (8bit):	3.6999155957209426
Encrypted:	false
MD5:	3E30F3CB3E507E67C56838067E44B2D9
SHA1:	3BD55A4D0C05EC684DED3F10A25DC975A6A4CF6A
SHA-256:	EAC93A44CCF5DCA4B850F37252E13FD4F0D81D6A2017FE82DB877823295D29D3
SHA-512:	C27F6A20AC26EAEC00C1FF2CD348E3942F15FD24C90C42257B4848E23C633023A86391758BE4459CC7C3EDD0B7DE6337E735C31D20373E2E2E427B5939B1D122
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1.6.5...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.3.2.0.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6DEF.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Size (bytes):	4509
Entropy (8bit):	4.4695697308623625
Encrypted:	false
MD5:	FEC9F820D686D9CBD4DB6E69F88D752D
SHA1:	9E1E33DB3F2C2CAAEF8EF8983A329704F35D67F5
SHA-256:	6E98BE6D5546E6D75A6A24802F702ABB2396D208AEC578139650AF5D95031AB5
SHA-512:	6A41FB602918A17308B548297F27D384DEDCB0B2686DCCB2643F2DE4C8FAA8C75AED6D51511C9BFAB65F401EBEBC04306605F49908EFEE81DDE6A0A9C0D40734
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="165" />.. <arg nm="verqfe" val="165" />.. <arg nm="csdbld" val="165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="967522" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.165.17134.0-11.0.75" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="2048" />

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.774164647726848
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Locky.exe
File size:	184320
MD5:	b06d9dd17c69ed2ae75d9e40b2631b42
SHA1:	b606aaa402bfe4a15ef80165e964d384f25564e4
SHA256:	bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3
SHA512:	8e54aca4feb51611142c1f2bf303200113604013c2603eea22d72d00297cb1cb40a2ef11f5129989cd14f90e495db79bffd15bd6282ff564c4af7975b1610c1c
SSDEEP:	3072:gzWgfLlUc7CIJ1tkZaQyjhOosc8MKi6KDXnLCtyAR0u1cZ86:gdLl4wkZa/UDiD7ukst1H6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3`..3`..3`.r,j..3`../n..3`.r,d..3`..3a..3`..,s..3`..3`..3`.r,k..3`."5f..3`.Rich.3`.........PE..L....>.B...................

File Icon


Icon Hash:	0b03039bb7b199ab

Static PE Info

General
Entrypoint:	0x40c0dc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x42B63E17 [Mon Jun 20 03:55:03 2005 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	0fcea3af550ad0a893e93808dccf17f4

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 0040D2C8h
push 00407625h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [00400D74h]
pop ecx
or dword ptr [007B67E8h], FFFFFFFFh
or dword ptr [007B67ECh], FFFFFFFFh
call dword ptr [0040D0FCh]
mov ecx, dword ptr [007B67E4h]
mov dword ptr [eax], ecx
call dword ptr [0040D0E8h]
mov ecx, dword ptr [007B67E0h]
mov dword ptr [eax], ecx
mov eax, dword ptr [0040D104h]
mov eax, dword ptr [eax]
mov dword ptr [007B67F0h], eax
call 00007F34985B2515h
cmp dword ptr [004127B0h], ebx
jne 00007F34985B240Eh
push 0040C258h
call dword ptr [0040D108h]
pop ecx
call 00007F34985B24E7h
push 0040F00Ch
push 0040F008h
call 00007F34985B24D2h
mov eax, dword ptr [007B67DCh]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [007B67D8h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0040D110h]
push 0040F004h
push 0040F000h
call 00007F34985B249Fh

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[C++] VS98 (6.0) build 8168
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd2d4	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3b7000	0x190c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd000	0x270	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb2cc	0xc000	False	0.669230143229	data	6.53694188411	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xd000	0x10c2	0x2000	False	0.255859375	data	3.3412568532	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf000	0x3a77f4	0x4000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x3b7000	0x190c8	0x1a000	False	0.797964242788	data	7.04430456199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x3b8df0	0xb2d	data
RT_ICON	0x3b9630	0xb90	data
RT_ICON	0x3b9e70	0xaeb	data
RT_ICON	0x3ba6b0	0x94c	data
RT_MENU	0x3b7b28	0x4e	data
RT_MENU	0x3b7b78	0x21e	data
RT_DIALOG	0x3b7d98	0x162	data
RT_DIALOG	0x3b7f00	0x192	data
RT_DIALOG	0x3b8098	0x17e	data
RT_DIALOG	0x3b8218	0xee	data
RT_DIALOG	0x3b8308	0xb8	data
RT_DIALOG	0x3b83c0	0x180	data
RT_DIALOG	0x3b8540	0x96	data
RT_DIALOG	0x3b85d8	0x128	data
RT_DIALOG	0x3b8700	0x1b6	data
RT_DIALOG	0x3b88b8	0xb8	data
RT_DIALOG	0x3b8970	0xb0	data
RT_DIALOG	0x3b8a20	0x172	data
RT_DIALOG	0x3b8b98	0xfc	data
RT_DIALOG	0x3b8c98	0x152	data
RT_ACCELERATOR	0x3baf18	0x18	data
RT_ACCELERATOR	0x3baf30	0x20	data
RT_ACCELERATOR	0x3baf50	0x20	data
RT_ACCELERATOR	0x3baf70	0x48	data
RT_ACCELERATOR	0x3bafb8	0x60	data
RT_ACCELERATOR	0x3bb018	0x30	data
RT_ACCELERATOR	0x3bb048	0x68	data
RT_ACCELERATOR	0x3bb0b0	0x40	data
RT_ACCELERATOR	0x3bb0f0	0x40	data
RT_ACCELERATOR	0x3bb130	0x28	data
None	0x3baef0	0x5	data
None	0x3bb158	0x121d5	data
None	0x3cd330	0x2d96	data
None	0x3baf10	0x1	very short file (no magic)
None	0x3baef8	0x12	data
RT_GROUP_ICON	0x3b9618	0x14	data
RT_GROUP_ICON	0x3b9e58	0x14	data
RT_GROUP_ICON	0x3ba698	0x14	data
RT_GROUP_ICON	0x3baed8	0x14	data
RT_VERSION	0x3b7840	0x2e8	data

Imports

DLL	Import
ADVAPI32.dll	GetSecurityDescriptorDacl, RegisterEventSourceA, RegQueryInfoKeyA, GetSidSubAuthorityCount, RegSetValueExA, RegDeleteKeyA, GetKernelObjectSecurity, RegCloseKey, RegQueryValueA, RegLoadKeyA, GetSidSubAuthority, RegConnectRegistryA, LookupPrivilegeValueA, InitiateSystemShutdownA, CreateProcessAsUserA, GetSidIdentifierAuthority, OpenThreadToken, LsaQueryInformationPolicy, RegQueryValueW, EncryptFileW, RegSetValueW, MakeAbsoluteSD, RegOpenKeyExA, RegCreateKeyExW, AddAce, SetNamedSecurityInfoW, OpenEventLogW, GetUserNameW, SetSecurityDescriptorSacl, MakeSelfRelativeSD, RegFlushKey, InitializeSecurityDescriptor, InitializeAcl, SetEntriesInAclA, GetSidLengthRequired, RegSetValueA, SetEntriesInAclW, GetAclInformation
USER32.dll	DrawIconEx, IsDialogMessageA, OffsetRect, PostThreadMessageW, DialogBoxParamA, GetLastActivePopup, GetGUIThreadInfo, DrawStateA, IsWindow, OpenClipboard, InSendMessage, FindWindowW, IsMenu, EnumDisplaySettingsA, DrawAnimatedRects, FrameRect, SetMenuDefaultItem, GrayStringW, CreateDialogIndirectParamW, ClientToScreen, GetParent, TranslateMDISysAccel, CreateDesktopW, ShowCaret, GetProcessWindowStation, TrackPopupMenu, IntersectRect, DialogBoxIndirectParamA, DefWindowProcA, ReuseDDElParam, NotifyWinEvent, SetClipboardData, CloseClipboard, DdeDisconnect, GetClassNameA, GetCaretPos, CharLowerW, GetWindowModuleFileNameA, IsWindowVisible, wvsprintfA, ModifyMenuA, SendDlgItemMessageW, SetCaretBlinkTime, LoadMenuW, GetMenuState, DrawTextExA, ChangeDisplaySettingsW, CreateWindowExW, GetCapture, CreatePopupMenu, SetMenu, CharUpperBuffW, DrawStateW, LoadImageA, GetScrollPos, GetDlgItem, GetClipboardFormatNameW, ValidateRgn, GetWindowThreadProcessId, GetClassInfoExW, DdeAccessData, ShowWindow, GetKeyboardLayout, GetClassInfoW, SetCaretPos, LoadCursorA, FillRect, LoadMenuA, mouse_event, ModifyMenuW, InvalidateRgn, GetMenuItemID, IsIconic, OemToCharA, LoadCursorFromFileW, RegisterWindowMessageA, DispatchMessageW, GetCursorPos, CharPrevA, GetWindowWord
IMM32.dll	ImmGetProperty, ImmGetCandidateListCountA, ImmGetCompositionStringA, ImmSetConversionStatus, ImmSetOpenStatus, ImmCreateContext, ImmGetOpenStatus, ImmNotifyIME, ImmInstallIMEA, ImmGetContext, ImmDestroyContext, ImmSimulateHotKey, ImmConfigureIMEA, ImmAssociateContext
RASAPI32.dll	RasDialA, RasGetProjectionInfoA
KERNEL32.dll	WriteFileGather, PulseEvent, GetLongPathNameA

Version Infos

Description	Data
LegalCopyright	Intend (C) 2013
InternalName
FileVersion	0.37.213.27
CompanyName	FileSee.com
PrivateBuild
LegalTrademarks
Comments
ProductName	Lipreading Fenced
SpecialBuild
ProductVersion	0.144.212.113
FileDescription
OriginalFilename

Network Behavior

Download Network PCAP: filtered – full

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 14, 2020 08:24:43.915163040 CEST	49971	53	192.168.2.6	8.8.8.8
May 14, 2020 08:24:43.940545082 CEST	53	49971	8.8.8.8	192.168.2.6
May 14, 2020 08:25:00.766048908 CEST	61139	53	192.168.2.6	8.8.8.8
May 14, 2020 08:25:00.811672926 CEST	53	61139	8.8.8.8	192.168.2.6
May 14, 2020 08:25:03.822190046 CEST	58139	53	192.168.2.6	8.8.8.8
May 14, 2020 08:25:03.872055054 CEST	53	58139	8.8.8.8	192.168.2.6
May 14, 2020 08:25:04.469990015 CEST	57653	53	192.168.2.6	8.8.8.8
May 14, 2020 08:25:04.531723976 CEST	53	57653	8.8.8.8	192.168.2.6
May 14, 2020 08:25:04.860331059 CEST	61083	53	192.168.2.6	8.8.8.8
May 14, 2020 08:25:04.893973112 CEST	53	61083	8.8.8.8	192.168.2.6
May 14, 2020 08:25:05.077032089 CEST	61122	53	192.168.2.6	8.8.8.8
May 14, 2020 08:25:05.125576019 CEST	53	61122	8.8.8.8	192.168.2.6
May 14, 2020 08:25:37.817317963 CEST	50558	53	192.168.2.6	8.8.8.8
May 14, 2020 08:25:37.842662096 CEST	53	50558	8.8.8.8	192.168.2.6

Code Manipulations

Statistics

CPU Usage

• Locky.exe
• WerFault.exe

Click to jump to process

Memory Usage

• Locky.exe
• WerFault.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Locky.exe PID: 2320 Parent PID: 1108

Function Logs

General

Start time:	08:24:08
Start date:	14/05/2020
Path:	C:\Users\user\Desktop\Locky.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Locky.exe'
Imagebase:	0x400000
File size:	184320 bytes
MD5 hash:	B06D9DD17C69ED2AE75D9E40B2631B42
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

File Activities

Section Activities

Sections loaded by Windows

Registry Activities

Thread Activities

Thread Delayed

Memory Activities

Memory Allocated

Memory Usage Statistics

System Activities

Windows UI Activities

Window UI Enumerated

LPC Port Activities

Chronological Activities

Analysis Process: WerFault.exe PID: 5524 Parent PID: 2320

Function Logs

General

Start time:	08:25:33
Start date:	14/05/2020
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 452
Imagebase:	0x2c0000
File size:	434584 bytes
MD5 hash:	80E91E3C0F5563E4049B62FCAF5D67AC
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

File Activities

File Opened

File Created

File Deleted

File Written

File Attributes Queried

Other File Operations

Section Activities

Sections loaded by Windows

Sections loaded by Program

Registry Activities

Key Opened

Key Created

Key Deleted

Key Value Created

Mutex Activities

Mutex Created

Process Activities

Process Queried

Process Information Set

Thread Activities

Thread Created

Thread Execution Resumed

Thread Execution Suspended

Thread Delayed

Thread Terminated

Thread Information Set

Memory Activities

Memory Usage Statistics

System Activities

Language or Locale ID Queried

System Information Queried

Windows UI Activities

Window Created

Process Token Activities

Token Adjusted

Object Security Activities